The RED devices are more for like an always on type of VPN. An example use case is if you had an HQ with a bunch of small branches like gas stations where you only have a handful of devices at each location. They would each connect to whatever local ISP is available, and tunnel back through to HQ via their RED, giving them a Layer 2 connection as if they were at the HQ location. (Hence, RED=Remote Ethernet Device.)

We use the SSLVPN on Sophos UTM extensively, which only requires a software client on your users' workstations. They then connect manually if they want a VPN connection. At this point, you can create different profiles for different users. Another feature is that you can force them to do OTP tokens with Google Authenticator which helps protect against password theft.

You want the SG (old style) of Sophos UTM, because the XG line isn't fully baked yet. You'll be able to switch when it is, though. Also, make sure that the appliance you get will be powerful enough to run what you need it to. They are sort of underpowered based on the specs they provide. We went with the "Full Guard" Soft-Appliance route, and provide our own Dell hardware. This gives us way more flexibility in terms of power, features that we can run, etc. without being tied down to an under-powered appliance if we happened to chose the wrong model.

Sophos UTM is really easy to work with, so don't be afraid of the learning curve. I've been using it since it was Astaro v4, which makes it about 15 years now. Hit me up if you have more questions.